Last updated: September 12, 2026
KDraw Kids ("the App") is a drawing and coloring app for young children. It is published on the Apple App Store, where it sits in the Kids Category, and on Google Play, where it takes part in the Families programme. The App is directed to children.
Versions before 1.5 on iPhone and iPad, and before 2.2 on Android, carried no advertising at all. Version 1.5 on iPhone and iPad and version 2.2 on Android show occasional ads, and this page explains exactly what that means. Everything below is written per platform, because the two builds do not use the same advertising partners.
This policy is published in English, and the English text is the authoritative version. Any translation of it, wherever it appears, is provided for convenience only.
Hezi Medina
Holland 6, Afula, Israel
Telephone: +972 50 848 1805
Email: webhym@gmail.com
We are the operator responsible for the App, on both platforms. This policy covers every version of the App: the iPhone and iPad version on the Apple App Store, and the Android version on Google Play and other Android stores.
The only code in the App that uses the Internet is the advertising software described below, and it is supplied by third parties. Those third parties receive certain technical information in order to send an ad to the device. The two sections that follow list that information platform by platform.
Google Play's Data safety section for the Android version therefore shows data as collected and as shared, and it lists the same things this page lists: the approximate location inferred from the IP address, app interactions, diagnostics, and device or other identifiers, used for advertising, analytics and fraud prevention. That entry describes the advertising software built into the App. It does not mean that we receive any of it.
On iPhone and iPad the App has exactly one advertising partner: Kidoz Inc., a contextual advertising network for children, through the Kidoz SDK built into the App (Kidoz privacy policy, Kidoz Safe Ad Policy).
The iOS version of the App contains no Google advertising software: no Google Mobile Ads SDK, no Google consent software, and no mediation layer of any kind. Kidoz is integrated directly, and Kidoz is the only advertising partner the App sends an ad request to. When Kidoz renders an ad, parts of the creative may be loaded from Kidoz's own content servers or from the advertiser's, and any host that serves part of a creative sees the IP address of the connection, in the way that every web request reveals it.
Kidoz states that it is certified under PRIVO's COPPA Safe Harbor and GDPRkids programmes (PRIVO certification page), that it serves contextual ads only, and that every ad campaign is reviewed manually by its in house team for relevance and appropriateness. On that basis we confirm that Kidoz provides the same or equal protection of user data as this policy states and as the App Store Review Guidelines require, and that Kidoz requires the same of the suppliers that load a creative on its behalf.
The App shows an occasional full screen ad, and only on the home screen, a moment after a child has finished a drawing or coloring activity and returned there. An ad is never shown when the App opens, never during drawing or coloring, never in the gallery, never inside the grown ups' settings, and never when the App comes back from the background. The App also shows no ads at all during its first three launches, and it does not even start the advertising software during those launches.
After that, the App limits itself: at least three finished activities between any two ads, at most two ads in one sitting, at most four ads per day, at least ninety seconds after a sitting begins, and a four minute gap between ads. These counters are kept on the device, by the App itself, and are described under What the App stores on the device.
To send an ad to the device, Kidoz receives:
com.hym.kidsdraw), so that the ad
matches this app and its age group;The ad creative itself is loaded by the Kidoz software, and may be fetched from Kidoz's own content servers or from the advertiser's.
This information is used to choose and deliver a contextual ad, to cap how often an ad is shown, to measure that the ad was displayed, and to detect invalid or fraudulent ad traffic. Kidoz also uses these ad events in aggregate, without identifying any device or person, to measure how its own ads performed and to promote its advertising service. Apple's App Privacy label records those two uses as Analytics and as Developer's Advertising or Marketing. They are Kidoz's uses of Kidoz's own data, and the App contains no analytics software of ours. This information is not used to contact any specific individual, to build a profile of any individual, or for behavioural advertising.
Tapping an ad can open an App Store page or a web page, either inside the App or by leaving it for the browser. Kidoz documents mandatory age gates on external links on iOS, and its software carries its own age gate for that purpose, so a tap that would leave the App passes through Kidoz's gate. The App itself adds no link that leaves the child's play context without our own parental gate in front of it. Once a store page or a browser is open, what happens there is governed by Apple's or the destination site's own terms and privacy policies, not by this one.
The links the App itself adds, the "Report an ad" mail and the link to this policy, both sit inside the grown ups' settings, behind the App's parental gate.
This section describes the Android version only. None of it applies to the iPhone and iPad version, which is covered in the section above. The two builds do not share an advertising partner, an advertising library, or a list of what is collected.
On Android, ads are delivered by Google LLC (AdMob) (Google's privacy policy). Kidoz Inc. (Kidoz privacy policy) is available to AdMob as a mediated ad source, so some ads on Android are supplied by Kidoz through Google's mediation. Kidoz serves contextual ads only on Android as well. Google Play publishes a list of advertising software that is self certified for its Families programme, and both Google's Mobile Ads SDK and the Kidoz SDK appear on that list.
As on iPhone and iPad, the App shows occasional full screen ads, and only after a child has finished a drawing or coloring activity and returned to the home screen. Ads are never shown when the App opens, never during drawing, and never in the parent protected gallery.
To deliver an ad, our Android advertising partners receive: the device's IP address, which allows an approximate location to be inferred and is what the ad is transmitted to; in app interaction events such as an app launch or an ad view; and diagnostic information about app and SDK performance. This information is used only for delivering the ad, for measuring that it was shown, for aggregated reporting, and for fraud prevention and security.
The advertising software also uses the App Set ID, an identifier that Android scopes to this developer's apps on this one device and that the device owner can reset. In line with Google's terms for that identifier, it is used only for analytics and for detecting invalid or fraudulent ad traffic. It is never used for ads personalization and never for ads measurement, and it is never connected to the Android Advertising ID, to any other Android identifier, or to any personal information.
Every ad request from the Android App is tagged as directed to children and capped at content rating "G". As a direct result:
AD_ID permission, and the Android Advertising ID (AAID) is not collected or
transmitted. Neither are SIM Serial, Build Serial, BSSID, MAC, SSID, IMEI or IMSI.The App keeps the following on the device, and nothing else:
None of this is sent anywhere, and all of it is removed when the App is uninstalled. If the device owner has iCloud Backup or Android backup switched on, the operating system includes these files in that backup, under the device owner's own account.
Separately, the advertising software supplied by our partners may store information on the device and read it back, for its own operational purposes such as capping how often an ad is shown and detecting invalid or fraudulent ad traffic. On Android, Google's "limited ads" serving mode, which this App requests, does not use cookies or device storage for advertising purposes; Google describes the limited amount of information it may still store or read as strictly operational.
The App never asks a child a question about advertising or data, on either platform. Every user of the App is below the age at which consent can validly be given, so the App states that fact to its advertising partners instead of putting a question in front of a child.
On iPhone and iPad: the Kidoz SDK has no consent interface, and none is used. Kidoz treats every user of its network as a child and serves contextual ads only.
On Android: every ad request is tagged as coming from a user below the age of consent, carries no consent string, and explicitly asks Google for the "limited ads" serving mode. We disclose the operational device storage described above here, because no consent dialog is ever shown in the App.
On iPhone and iPad: the App asks for one permission and only one, and only if a grown up switches on "also save artwork to the photo gallery" in the parental settings, which starts switched off. That is the system's add only photo permission, which lets the App add a picture and never lets it read, browse or look at anything already in the library. If the permission is declined, the App keeps working and artwork is still saved in its own gallery. The App asks for no camera, microphone, contacts or location access, and it never shows a tracking prompt.
On Android: the App itself requests two permissions, and both are required in
order to fetch an ad: INTERNET and ACCESS_NETWORK_STATE. The advertising
software built into the App also declares two standard Android permissions, WAKE_LOCK
and FOREGROUND_SERVICE, which it uses for its own background work such as finishing the
download of an ad. Neither of them gives access to any personal information, and Android does not
ask the user to grant them. The App does not request the advertising ID permission, camera,
microphone, contacts, location or storage permissions.
Drawings created in the App are stored only on the device, inside the App's own private storage. Nothing is uploaded anywhere. Artwork is never sent to us and is never shared with our advertising partners.
If a grown up turns on "also save artwork to the photo gallery" in the parental settings, a finished picture is copied to the device photo library as well. On Android that is the "Pictures/KDraw Kids" folder; on iPhone and iPad it uses the add only photo permission described above, and the setting starts switched off.
Artwork leaves the device only if a grown up explicitly shares it with the share button, which is protected by a parental gate. Sharing hands the picture to the system share sheet, and from that point the app the grown up chose (Messages, Mail, WhatsApp, Files, AirDrop and so on) handles it under its own privacy policy.
The App is directed to children under 13. This section is the notice required by the Children's Online Privacy Protection Rule, including the notice elements added by the 2025 amendments (16 C.F.R. section 312.4(d)).
What is collected. The only information collected in connection with the App is the technical and persistent information listed in the two advertising sections above: on iPhone and iPad, the IP address of the connection, a random short lived session identifier, the app's bundle identifier, the iOS version, the device language, the carrier name where the operating system still provides one, and ad interaction events; on Android, the IP address, in app interaction events, diagnostic information and the App Set ID, an app scoped identifier that is not an advertising identifier and is used only for analytics and fraud detection. No other personal information is collected. We ourselves receive none of it.
The specific internal operations it is collected for. Contextual ad serving, frequency capping, invalid traffic and fraud detection, and aggregated reporting. That is what the Rule calls support for the internal operations of an online service. The IP address and the short lived session identifier are persistent identifiers as the Rule defines them, and they are collected only to support these internal operations and for nothing else.
How we ensure these identifiers are not used or disclosed to contact a specific individual, including through behavioural advertising, or to amass a profile.
Third parties that receive this information, by name and category, and the purpose of each disclosure.
Apart from these, the content delivery hosts that load the creative itself see the IP address of the connection, as any host does when a request reaches it. They act only as Kidoz's suppliers, they receive nothing else from the App, and Kidoz binds them to the standard described above. Nothing is sold, and nothing is disclosed for any purpose other than the ones named here.
Retention. See Data retention below.
Parental rights. A parent or guardian may review what has been collected, have it deleted, and refuse to permit any further collection. See Parental rights, reporting an ad, and deletion.
Because no other personal information is collected, and because these identifiers are never used to contact or profile an individual, verifiable parental consent is not required for this collection under 16 C.F.R. section 312.5(c)(7).
Every user of the App is below the age of digital consent in every EEA member state, so we do not rely on consent as a lawful basis and we do not ask a child to consent to anything.
On Android, ad requests are tagged as coming from a user below the age of consent, which suppresses any consent form and restricts serving to limited, non personalised ads. On iPhone and iPad the Kidoz SDK has no consent interface, treats every user as a child, and serves contextual ads only; Kidoz states that it is certified under PRIVO's GDPRkids programme.
IP addresses and the short lived session identifier are processed on the basis of our legitimate interest in delivering and securing the advertising that funds a free children's app, balanced by the restrictions described throughout this policy: contextual ads only, no advertising identifier, no profiling, and short retention at our partners.
A parent may exercise the rights of access, erasure, restriction and objection by writing to webhym@gmail.com. We will respond within 30 days. A parent who is not satisfied with how we handled a request may also lodge a complaint with the data protection authority of their own country.
We are based in Israel, and our advertising partners may process the information described above outside the EEA under their own published safeguards; Kidoz's are described in its privacy policy, linked above.
The only network traffic the App produces is the advertising traffic described above, and it travels to our advertising partners over encrypted HTTPS connections. We operate no server, hold no database and have no account system, so there is nothing of ours holding information about a user that could be broken into.
Drawings, the two grown up settings and the App's ad counters stay in the App's own private storage on the device. The operating system keeps that storage separate from other apps, and it is covered by the device's own passcode and disk encryption. The App never copies any of it off the device.
Our advertising partners are responsible for securing the information their own software sends to them, under the published policies linked above. We choose partners that publish a children's privacy programme, and Kidoz states that it holds a third party certification under PRIVO's COPPA Safe Harbor and GDPRkids programmes, on the PRIVO certification page linked above.
If an ad seems unsuitable for a child, please tell us. Inside the iPhone and iPad App there is a "Report an ad" row in the grown ups' settings, behind the parental gate; it opens a mail to webhym@gmail.com carrying the app version, the build number and the time, and nothing about the device or the child. The same settings dialog also links to this policy and carries a short line saying what an ad is chosen from. On either platform you can simply write to webhym@gmail.com. It helps to say what the ad showed, roughly when, and on which device. We use the address you write from and the message only to answer you and to forward the report to the advertising partner that served the ad, Kidoz on iPhone and iPad and Kidoz or Google on Android, and for nothing else.
A parent or guardian may contact us at webhym@gmail.com to ask what information relating to their child the App may have caused to be collected, to request its deletion, or to refuse any further collection. We will respond within 30 days. Because we hold no data ourselves, a deletion request is forwarded to the relevant advertising partner: Kidoz Inc. for iPhone and iPad, and Google or Kidoz for Android. A parent may also write to Kidoz directly using the contact details in Kidoz's own privacy policy.
A parent who wishes to stop all ad related data collection immediately can uninstall the App. All drawings are removed with it.
Actions that leave the child's play context, meaning sharing artwork, deleting artwork, resetting coloring pages, and opening the grown ups' settings, are protected by a parental gate. The gate asks the reader to press and hold a button of a specific colour, named in words, for three seconds. The colour changes every time, and holding the wrong button closes the gate, so getting through takes reading the instruction rather than guessing. The "Report an ad" mail and the link to this policy both sit behind that gate.
We will update the "Last updated" date above whenever this policy changes, and we will publish any change before the corresponding App update reaches the App Store or Google Play.
Hezi Medina, Holland 6, Afula, Israel
Telephone: +972 50 848 1805
Email: webhym@gmail.com